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applying the hash function on the message to produce the series of k 
values bi,...,bk; and 

verifyinglthat the equations Pi(ei ? ... 5 e n +v ? bi,... ? bk)=0 ? ... ? 
P k (ei v ..,e n + V , bi,... 5 b k )=0 kre satisfied. 

Kindly amend claim 4 as follows: 

4. (Amended) A metftod according to claim 1 and wherein the method comprises 
an HFEV scheme and the \et S2 comprises [the] a set f(a) of k polynomial functions of 
the HFEV scheme. 

Kindly ameiJd claim 5 as follows: 

5. (Amended) A methoo according to claim 1 and wherein the method comprises a 
UOV scheme and the set S2 Comprises [the] a set S of k polynomial functions of the 
UOV scheme. 

Kindly amend ilaim 6 as follows: 

6. (Amended) A method according to claim 1 and wherein said supplying [step] 
comprises [the step of] selecting the number v of "vinegar" variables to be greater than 
the number n of "oil" variables. 

Kindly amend cldim 7 as follows: 

7. (Amended) A method according to claim 1 and wherein v is selected such that 
q v is greater than 2 32 , where q is t^e number of elements of a finite field K over which 
the sets SL S2 and S3 are provide 



Kindly amend claim\8 as follows: 
8. (Amended) A method according to claim 1 and wherein said supplying [step] 
comprises [the step of] obtaining thdset SI from a subset S2' of k polynomial functions 
of the set S2, the subset S2' being characterized [by] in that all coefficients of 
components involving any of the yi,.Lyk variables in the k polynomial functions 
P^(a l5 ... 5 a n+ v,yi 5 ...,yk) ? ..-,P\(ai...,a n A,yi,... 5 yk) are zero, and the number v of "vinegar" 
variables is greater than the number n pf "oil" variables. 
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Kindly amend claim 9 as follows: 

9. (Amended) A method according to claim 8 and wherein the set S2 comprises 
[the] a_set S of k polynomial functions of [the] a UOV scheme, and the number v of 
"vinegar" variables is selected [so as] to satisfy one of the following conditions: 

(a) for each characteristic p other than 2 of a field K in an "Oil and 
Vinegar" scheme of degree 2, v satisfies the inequality 

q (v-n)-i * n 4 L 2 4o ? w here K is a finite field over which the sets Sh S2 and 
S3 are prowded, 

(b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater 
than n*(l + pqrt(3)) and [lower] less than or equal to n 3 /6, and 

(c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 3, v 
is greater thap n and [lower] less than or equal to n 4 . 

Kindly amendl claim 10 as follows: 

10. (Amended) A method according to claim 8 and wherein the set S2 comprises 
[the] a_set S of k polynomial functions of [the] a_UOV scheme, and the number v of 
"vinegar" variables is selected [so as] to satisfy the inequalities v<n 2 and q (v_n) " 1 * n 4 
>2 40 for a characteristic p=2 ojf a field K in an "Oil and Vinegar" scheme of degree 2 a 
where K is a finite field over \yhich the sets SK S2 and S3 are provided and q is the 
number of elements of K. 

Kindly amend cfeim 15 as follows: 
15. (Amended) In an "Oil arid Vinegar" signature method, an improvement 
comprising [the step of] using more "vinegar" variables than "oil" variables. 



J Kindly amend claiAi 16 as follows: 

16. (Amended) A method according to claim 15 and wherein a_[the] number v of 
"vinegar" variables is selected [so as] to satisfy one of the following conditions: 

(a) for each characteristic p other than 2 of a field K and for a degree 2 
of the "Oil and Vinegar" signature method, v satisfies the inequality q (v " n)_l * n 4 
> 2 40 , where n is a number of roil" variables. K is a finite field from which the n 
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"oil" variables and the v "vinegar' 1 variables are selected, and q is the number of 
elements of K, 

(b) fonp = 2 and for a degree 3 of the "Oil and Vinegar" signature 
methoq, v is greater than n*(l + sqrt(3)) and [lower] less than or equal to 
n 3 /6, 

(c) for dlach p other than 2 and for a degree 3 of the "Oil and Vinegar" 
signature method, v is greater than n and [lower] less than or equal to n 4 . 

Kindly amend claim 17 as follows: 
17. (Amended) A method according to claim 15 and wherein [the set S2 comprises 
the set S of k polynomial {functions of the UOV scheme, and the] a number v of 
"vinegar" variables is selected [so as] to satisfy the inequalities v<n 2 and q (v_n) " 1 * n 4 
>2 40 for a characteristic p=G of a field K in an "Oil and Vinegar" scheme of degree 2 A 
where n is a number of "oilv variables. K is a finite field from which the n "oil" 
variables and the v "vinegai\ f variables are selected, and q is the number of elements of 
K. 



Kindly add the following new claims: 




—18. A signature generator Comprising: 

a signature input receiver operative to receive a set SI of k polynomial 
functions as a public-key and a message to be signed, the set S 1 including the functions 
P I (x l ,... ? x n -f V , yi,...,yk),..., Pk(xi,\..,x n +v, yi,...,yk). where k, v, and n are integers, 
xi,...,x n + v are n+v variables of a first type, yi,...,yk are k variables of a second type, and 
the set S 1 is obtained by applying\a secret key operation on a set S2 of k polynomial 
functions P*i(ai,...,a n +v 9 yi,...,yk),..\ 5 P 9 k(ai,...,a n + V ,yi,...,yk), where ai,...,a n+v are n+v 
variables which include a set of n "^il" variables ai,...,a n , and a set of v "vinegar" 
variables a n +i,.-.,a n +v; and 

a signature processor operatiVely associated with the signature input receiver 
and operative to perform the following operations: 

to apply a hash functiop on the message to produce a series of k values 

bi,...,bk, 
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to substitute the series of k values bi,...,bk for the variables yi,...,yk of the 
set S2 respectively to jbroduce a set S3 of k polynomial functions P"i(ai,...,a n + V ),..., 
P"k(ai ? ...,a n+V ), I 

to selectlv values a'„+i 9 — >a'n+v for the v "vinegar" variables a n +i 5 ... ? a n + v ; 

to solve i set of equations P"i(ai,...,a n5 aVu..,aVv) = 0,..., 
P"k(ai 5 ... 5 an 5 a'n+i,..* 9 a'n+vJ=0 to obtain a solution for a'i ? ...,a 5 n ; and 

to apply the secret key operation to transform a'i,...,a' n +v into a digital 
signature ei,...,e n + v . \ 

1 9. Apparatus according to claim 1 8 and also comprising a signature verifier 
operatively associated withlthe signature processor and operative to verify the digital 
signature. \ 

20. Apparatus according to claim 1 9 and wherein said signature verifier is operative 
to verify the digital signature by performing the following operations: 

obtaining the signature ei,...,e n + v , the message, the hash function and the public 
key; \ 

applying the hash function on the message to produce the series of k values 
bi,... 5 bk; and 1 

verifying that the equatkAis Pi(ei,...,e n + V ,bi 5 ...,bk) = 0,...,Pk(ei,...,e n + v? bi,...,b k ) 
= 0 are satisfied. \ 

21 . Apparatus according to claim 1 8 and wherein the signature processor is 
operative to perform an HFEV scheme, and the set S2 comprises a set f(a) of k 
polynomial functions of the HFEV scheme. 

22. Apparatus according to claim u 8 and wherein the signature processor is 
operative to perform a UOV scheme, and the set S2 comprises a set S of k polynomial 
functions of the UOV scheme. \ 

23. Apparatus according to claim 1 8\and wherein the number v of "vinegar" 
variables is greater than the number n of Voil" variables. 



NDS-4600 



PATENT 

-6- 

24. Apparatus according to claim 1 8 and wherein v is selected such that q v is 
greater than 2Y 2 , where q is the number of elements of a finite field K over which the 
sets SI, S2 ana S3 are provided. 

25. Apparatus according to claim 18 and wherein the set SI is obtained from a 
subset S2' of k polynomial functions of the set S2, the subset S2' being characterized in 
that all coefficients of components involving any of the yi,... ? yk variables in the k 
polynomial functions P'i(ai,. . .,a n + v ,y i,. ■ .,yk),. . .,P'k(ai,. . .,a n + v , 

yu - • ? yk) are zero, and the number v of "vinegar" variables is 
greater than the number n of "oil" variables. 

26. Apparatus according to claim 25 and wherein the set S2 comprises a set S of k 
polynomial functions\of a UOV scheme, and the number v of "vinegar" variables is 
selected to satisfy oneiof the following conditions: 

(a) for each characteristic p other than 2 of a field K in an "Oil and Vinegar" 
scheme of degree 2, v satisfies the inequality q (v " n)_I * n 4 > 2 40 , where K is a finite field 
over which the sets SI, S2 and S3 are provided, 

(b) for p = 2 in an\"Oil and Vinegar" scheme of degree 3, v is greater than n*(l 
+ sqrt(3)) and less than orequal to n 3 /6, and 

(c) for each p otheAhan 2 in an "Oil and Vinegar" scheme of degree 3, v is 
greater than n and less than or equal to n 4 . 

27. Apparatus according t© claim 25 and wherein the set S2 comprises 

a set S of k polynomial functions of a UOV scheme, and the number v of "vinegar" 
variables is selected to satisfy tne inequalities v<n 2 and q (v * n) I * n 4 >2 40 for a 
characteristic p=2 of a field K in an "Oil and Vinegar" scheme of degree 2 a where K is 
a finite field over which the sets SA, S2 and S3 are provided and q is the number of 
elements of K. \ 

28. Apparatus according to clairA 18 and wherein said secret key operation 
comprises a secret affine transformatic >n s on the n+v variables ai,. . . ,a n + v . 
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29. Apparatus according to claim 21 and wherein said set S2 comprises an 
expression including k functions that are derived from a univariate polynomial. 

30. Apparatusiaccording to claim 29 and wherein said univariate polynomial 
includes a univariate polynomial of degree less than or equal to 100,000. 

31. A signature Werifier for verifying the digital signature generated by the signature 
generator of claim le, the signature verifier comprising a verifier processor operative to 
perform the followirm operations: 

to obtain the signature ei,...,e n + v , the message, the hash function and the public 
key via the signature input receiver; 

to apply the hash function on the message to produce the series of k values 
bi,...,b k ; and \ 

to verify that thdiequations Pi(ei,...,e n -hv,bi,...,b k )=0,...,P k (ei,...,e n +v ? bi,...,b k )= 0 
are satisfied. \ 

32. In an "Oil and Vinegar" signature generating apparatus an improvement 
characterized in that the "Oil and Vinegar" signature generating apparatus is operative 
to use more "vinegar" variables than "oil" variables. 

33. An "Oil and Vinegar'\ signature generating apparatus according to claim 32 and 
wherein a number v of "vinegar" variables is selected to satisfy one of the following 
conditions: \ 

(a) for each characteristic p other than 2 of a field K and for a degree 2 of an 
"Oil and Vinegar" signature metnod, v satisfies the q^""*' 1 * n 4 > 2 40 , where n is a 
number of "oil" variables, K is a finite field from which the n "oil" variables and the v 
"vinegar" variables are selected, and q is the number of elements of K, 

(b) for p = 2 and for a degree 3 of the "Oil and Vinegar" signature method, v is 
greater than n*(l + sqrt(3)) and lessithan or equal to n 3 /6, and 

(c) for each p other than 2 ana for a degree 3 of the "Oil and Vinegar" signature 
method, v is greater than n and less tlran or equal to n 4 . 
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